PIAM - The Role of Identity and Access Management in Airport Security

Matthew Lewis, Product Marketing Director at HID Global, Russell Compton, Director of Aviation at HID Global, and Yves Massard, Director of Product Management at HID Global, take a vertical approach and discuss aviation around the world at a variety of airports. They address security at airports and how identity management solutions can assist in protecting employees and civilians.

Transcript

Speaker 1: 0:01

Powering trusted identities of the world's people, places and things. Every day, millions of people in more than 100 countries use our products and services to securely access physical and digital places over 2 billion things that need to be identified, verified, and tracked are connected through HID Global's technology.

Speaker 2: 0:23

Welcome everybody. Thanks for joining us again today. We've got another podcast on physical identity and access management. Today. We're gonna take a, a vertical approach. We're gonna talk about aviation, which is really been an interesting topic since I joined H I D that, um, it's a lot more nuanced than I would've expected. You know, we're all familiar with going to an airports. And we usually think of airport security in terms of us as the, the, the passenger or whatever entering through, uh, DHS checkpoints and all of that. But, but I've learned in that time, there's a lot more to it. Once you think about the actual airport and the employees of all the different companies that are in there and, and really how few of those are actually, uh, employed by the airport themselves. And so there's a really interesting relationship on the security side. When you think about all of those individuals that are there, uh, the barista at Starbucks, the person handling the, uh, the jewelry sales that is in the secured area, the, the members of DHS and, and TSA that are, that are walking through and all of those different things. And so today I've got Russ Compton and Eve Masar, and I'll let them give a quick introduction, um, on, and we're gonna spend a bit of time talking about identity management solutions in the aviation space. Um, Russ, before we get started, why don't you do a quick introduction on yourself? Tell

Speaker 3: 1:47

Us about, thanks a lot, Matt, and thanks for having me today. Um, again, I'm with H I D my name is Russell Compton. I'm the director for aviation. Uh, I've been involved in aviation about seven years. Um, and, uh, a lot of my peers in the industry I've been 20 plus years, but to tell you what, uh, I've enjoyed my time here and, and really been focused on identity management the whole time. So have a good background on that and look forward to talking more about that with you, Matt. Thank

Speaker 2: 2:16

Great. And what yourself?

Speaker 4: 2:20

Hey, thanks, Matt. Matthew. This is MAA with I, I'm a director of product management at I, and one of my area focus is the radiation vertical.

Speaker 2: 2:31

So, so what got us on this kind of episode, I guess you'd say today was we were talking, uh, a few weeks back and we're just kind of talking about the customer base. And by and large, we've got a pretty good set of customers. A lot of, lot of airports we travel through probably. Um, and we were doing a bit of a comparison of some of those larger airports and, and Russ, you made a point around smaller airports. There's actually a ton of them. Um, you know, small being a relative term, really, uh, in aviation, um, talking about a number of people, kind of walking through the airport and getting on planes and all that. But all of those airports we think about that are regional, or, you know, maybe flying from, um, out of like a little rock or an Oklahoma city or something like that. They're not the big SPOs. Lax is New York airports DFWs and things like that. But even they, uh, they, they know about these identity management solutions, but they may not view them the same way as some of those larger airports. And, and Russ, you made a comment about how a lot of times they may think they're too much, uh, to put that in quotes, um, those identity management solutions. Can you talk a little bit about why a smaller airport might think, um, a solution like ours, our identity management solution might be too much for them.

Speaker 3: 3:54

Yeah. And I think that's a great point and you can look at too much in, in multiple ways you can say, Hey, it's too much of a cost. Cuz we looked at it at one time and it was too much or it's too much for us to manage because we have limited resources and uh, I've been to events and I've talked to smaller airports and sometimes you get talking about hot topics and some of them might not relate to smaller airports. Uh, but it's, it's been this time with identity management where we have a mature product that started development back in 2003. And there are some changes rather radical recently with our solution that has enabled it, uh, to not be what you call too much. So I, I, one of the things I wanna share is airports pay by size with our software solution. Now, large airports always have a larger buying power, uh, generally, and you normally see that they can, uh, you know, afford enterprise products, but this particular identity management system, what we've done is, is scale it to work with the amount, the amount of badges that you have at the airport. So an airport, like you mentioned before, DFW might have, who knows 30, 40,000, uh, badges. We're gonna price that software solution based on that size. And, and that's gonna turn around and reflect and help a smaller airport get in, uh, to this, uh, identity management system. Part two of that, uh, is that you only have to buy what you need. Uh, the solution is modularized. Okay. But the baseline safe system that we deploy that all airports will get. We really think smaller airports can utilize that baseline system and not have to, you know, pick and choose from some of these modules that give you, you know, more of the Cadillac type service of it. Uh, and that saves on cost. And the last thing, and I know we'll get into a detail is it is a co solution commercial off the shelf, meaning you're gonna buy the same solution that the other airports are using and that's gonna be great because it's configurable. It is easy to set up and it's easy to maintain in the future. And we'll break that down in a minute, but, uh, really it is a, it is an entry level now for smaller airports to get in based on those reasons.

Speaker 2: 6:16

Do you have any thoughts on cuts out of the box? Those are all phrases you, and I know very well from kind of the product management product marketing world within software. Any, any thoughts on how that's maybe evolved, uh, in this space a little bit and how you think of that kind of, um, moniker? Really?

Speaker 4: 6:35

Yeah, definitely. So, uh, just to be, just to be clear, cuts means common of the shelf. Um, and the idea is that, uh, a customer is able to, uh, buy a product and, and deploy it, adding to do any customization. When you look at the aviation sector, a lot of the, a lot of the things that drives the, the existence of IDMs, uh, stem from nine 11 and the regulation that came after TSA was created, um, airports have to comply with those, those regulation. And a lot of that drives that. So the, the, the, the IDMs software that were created, you know, 2015 years ago, um, I've had a lot of time to mature and there's been a lot of, uh, commonality that, uh, that became clearer as, uh, as those solution were deployed at customers. And that enabled us to build a product that Scott's common of the shelf, where all the, all the required, um, capability that are needed to meet the, the TSA compliance are built into the product. We still see customers wanting to have the flexibility and customization, but if you are as medium size or smaller airport, you might be just fine with what comes out of the product. And if you take the product as is, and you might do configuration, but you don't need to do customization, you're gonna save, um, a lot of money in term of not adding to, uh, finance the custom development, but also not having to, uh, finance the maintenance of that custom development, which over the years, uh, do adapt. So, um, the maturation of, uh, the maturation of that industry, uh, and, uh, and the ability we had to be able to build what's needed into the product out of the box is really making it much more affordable to customer. And I also want to add that over the years, there's also additional delivery method that were not possible before. And one of one, that's very, that's more and on what popular popular is, uh, uh, being able to deliver that via other cloud instead of having to install that software on premise that also that also can, uh, significantly, um, cut the cost for customers, because it's not just about licensing the software, but it's also about running it and maintaining it. And that's, that's an area where also customer can, uh, benefit from, from savings, from, uh, evolution in the marketplace.

Speaker 2: 9:06

Yeah, that's a, that's a good point. I think, um, these kind of larger products that have kind of grown out of, of the higher end of the market as they've evolved and, and we've really pushed them into the, the cloud, um, it's really made a big impact on those smaller organizations being able to take something cuz um, you know, they're, they're not an it shop, um, nor should they be. So I think it's great to see us pushing that forward for, um, on that topic. Um, so just, uh, you know, Russ, you, you said something earlier that got me thinking a little different, uh, topic we've talked on, on commercial off the shelf and you touched on it a little bit, which is, I have to think some of these smaller airports think that there are, I don't know how to say this. Maybe their processes are sufficient today or, or, you know, they've got what they need that they're good enough. Um, we're getting by, uh, what should they think about the, these airports as they're thinking about whether that really is the case, uh, is there something that these identity management solutions like safe that we're talking about bring over and above? I, I don't even know what, what they're doing today really probably Excel and some other things PAC systems, but can you elaborate maybe on, on what, what processes we might be touching on?

Speaker 3: 10:31

Sure. Yeah. And then, and it, as long as you're following the regulations, of course, which are TSAs, uh, 1542, you are getting by and you are doing the right thing, but what brought, uh, an identity management system in terms of aviation was to market, uh, was it is very complex what you have to do. And we have put everything in terms of a workflow into one single solution, which is great, uh, and that eliminates, uh, duplicate data input. So any airport that has to go and capture information on a badge applicant and then submit that for a fingerprint, uh, which is gonna give you a, a background check into the FBI, you're already putting duplicate, I'm sorry, data information in. And then if you gotta go into a training or a learning management system, you gotta type in that person's information, uh, at that point. And then finally get to that point of, oh, I gotta put'em in the physical access control. Uh, one of the things that's really gonna help any airport regardless of size, but especially small airports too, who have limited resources is ability to type that information one time into one system. And then that system will disperse that information based on integrations. I think that's a huge thing as well. Uh, and the other thing I really you think about is TSA will eventually come knocking on the door and say, Hey, tell us us about, uh, this guy that we, you know, found in terminal three and, and, and had a badge X, Y, Z, whatever that investigation might be. You have that information in one single source of truth, which is the identity management system we call safe. Uh, and it's gonna have every information about when, when that badge was supplied, what training they've taken, uh, and really what's the history, uh, of their access around the airport. So it's gonna help you, uh, manage the process of any investigation or, or any questions that might come up on any particular badge holder.

Speaker 2: 12:27

Yeah. That makes sense. Being able to understand who's there, why they're there, who made decisions on the levels of access when those decisions were made, all of that definitely gonna play into an audit, definitely gonna be something that being able to print out a report, um, instead of, you know, oh, I'll get back to you in a week after I cobble that report together for you definitely makes, uh, it's gonna be a lot of savings. It's also gonna be a big risk reduction. Um, you know, in, in terms of, uh, having those auditors on site, being able to say, yeah, we, we applied, um, all the controls and, and policies we needed to. And here, here is that proof. That makes sense. You, you touched on something an, I want to actually pivot over to you. Russ talked a little bit about integration. Talk to me a little bit about that in this space. Cuz I heard hack, I heard, um, fingerprint systems. I heard, you know, all sorts training, all, all sorts of other systems. What, what role do you see integration playing as maybe, maybe a central part of this whole

Speaker 4: 13:28

Thing? Yeah, it's a, it's actually vital. Um, when you look at, uh, when you look at the offering of safe offering, it, it, it does provide you the, the ability to do the compliance, but the way it does that is by connecting to a lot of different systems. Yeah. Uh, you might be using, uh, an identity provider to onboard your, your identity, at least for the, the system users. Uh, you definitely will want to connect to a life scan in order to, to get to fingerprint the, the, the applicants. Um, you want to connect to your pack system so that the badge are provisioned and the provision as the, the badge are issued, they're lost they're, they're, they're, they're renewed and so on. Um, you may optionally want to connect to a training system to be able to recover the status of the training, having to manually put it into the system. So a lot of those integration are about automation, which means that it turns into savings for your organization, because it means that you have less manual things to do with the system. Also, it provides you with, uh, more to date, um, and, and I create a, a status on where you are for your applicants and, and the different steps of the process and the, the status of the, those different areas. Um, so the, the, the integration are really critical to the, to the deployment because you want to have things that deploy easily that are automated, that so that you don't have to maintain them as much. Um, and, and that's really how those integration helps you do that. Uh, the great thing about safe is that it comes with, uh, a large number of, of integration out of the box. Um, if one of your system is not, um, is not supported by safe, we can also, um, um, uh, we have standout packages in order to add additional integration, but there's a vast number of integration that comes off the box, which means that, uh, it's ready to go for most of the, the, the customers that are out there.

Speaker 2: 15:29

Yeah. I mean, again, I think back to one of the points for us made early on the Solutions's been in development for a number of years, especially with, uh, airports. So having those out of the, out of the box, off the shelf, whatever you wanna call them, uh, integrations is gonna be really important for the, the airports that aren't the, uh, DFWs of the world. Any, any examples from either of you, um, from customers you've had conversations with, and you don't have to name names, um, just maybe a example, uh, anecdote from any customer conversations about some, some ways this has helped them, maybe even some that maybe wouldn't expect.

Speaker 3: 16:09

Yeah. Let me give an example of customer we're currently deploying. Um, it's a small airport, uh, they've used our, our safe solution for a while, and now they're upgrading to our most recent platform. And with our most recent platform, we have an enhancement of, uh, a tablet solution that can be handed to a badge applicant where they can verify their information, uh, check boxes, uh, which have to do with disqualifying crimes. Have you, you know, asking that badge applicant, have you been involved in airport piracy, you know, 27 different questions or so about, um, what would disqualify you from having a job here? Well, this smaller airport said, Hey, we like to scan that information on disqualifying crimes. We also have them read this, this, uh, piece of paper about the privacy act, where we tell them we're gonna do a background check. So we're not really interested in doing the tablet. We wanna keep our standard process here. This solution has the ability to turn things on and often configure'em the way you like. So we, we were able to, uh, disable the functionality on the tablet, but also add the ability when capturing documents to require two additional documents on the, the back end, which are those scan documents. Uh, so it's, it's highly configurable and it's gonna fit, you know, needs of airports as, as you move forward. That's one example of just the configurability side.

Speaker 2: 17:31

It Eve I, I feel like I've heard<laugh>, uh, reference to a quote unquote, I safe room from one of our, our customers. Do you know the, the urban legend that I'm, that I'm talking about

Speaker 4: 17:43

Or, yeah, the GP, um, uh, uh, a NetApp customer had, uh, a room that was already dedicated in, uh, holding, uh, all the paperwork that the applicant would file. And by, uh, deploying safe, they were able to, because everything is digitized, they were able to get rid of that, uh, that archive room and, and reuse it for something else. So they called it the safe room because that room was freed up, uh, thanks to the deployment of safe,

Speaker 2: 18:13

Both funny and, and actually really powerful in kind of what it can do so well. Cool. Well, I'm give both of you a little bit of time back. Um, we've had a good conversation. I think there's probably some topics we can pick up in maybe another episode if you're amenable to that, but we've talked a little bit about, um, how we have advanced, I'd say the IDMs solutions now with, with our safe product over, over that 20 year plus partnership, um, almost 20 plus years partnership with, with the aviation space, how we've really driven that forward. A lot of the benefits that customers are gonna get, whether they're small, medium, large, um, and, and how that kind of modular approach, uh, we're taking with the solution can really make a big difference. Plus the managed services, uh, kind of aspect. So thank you both for your time and, uh, let's get out there and help solve some customer problems. I appreciate gentlemen,

Speaker 4: 19:10

Take seven. Thank you, Matt.

Speaker 2: 19:12

Take care.